Look up and validate DKIM signing records for any domain. Verify key type, key strength, testing mode, and check BIMI brand indicators.
Written by Ishan Karunaratne · Last reviewed:
DKIM (DomainKeys Identified Mail) is an email authentication protocol defined in RFC 6376. It allows a sending mail server to attach a cryptographic signature to outgoing messages. The signature is stored in a DKIM-Signature header and covers the message body and selected headers.
When a receiving mail server gets the message, it extracts the domain and selector from the DKIM-Signature header, queries DNS for the public key at selector._domainkey.domain.com, and verifies the signature. A valid signature confirms the message came from an authorized server and was not modified after signing.
DKIM is one of the three pillars of email authentication, alongside SPF and DMARC. DMARC policy enforcement requires either SPF or DKIM alignment to pass. Without valid DKIM, your domain is vulnerable to email spoofing and phishing attacks.
Sender signs the message
The sending mail server computes a hash of the message body and selected headers, then encrypts it with the private key. The result is added as a DKIM-Signature header.
Receiver looks up the public key
The receiving server extracts the d= (domain) and s= (selector) tags from the DKIM-Signature header, then queries DNS for the TXT record at selector._domainkey.domain.com.
Signature is verified
The receiver decrypts the signature using the public key and compares it to its own hash of the message. If they match, the message is authentic and unmodified.
The DKIM DNS record contains structured tags per RFC 6376 Section 3.6.1. The p= tag holds the base64-encoded public key, the k= tag specifies the algorithm (rsa or ed25519), and the optional t=y flag marks the record as being in testing mode.
RFC 8301 (Cryptographic Algorithm and Key Usage Update to DKIM) establishes RSA 2048-bit as the minimum recommended key size. Keys smaller than this are vulnerable to factoring attacks. RFC 8463 adds Ed25519 as a modern alternative with superior security-per-bit ratio.
Factored in minutes with commodity hardware. Replace immediately.
Below RFC 8301 minimum. Vulnerable to well-resourced attackers.
Current minimum per RFC 8301. Standard recommendation.
Very strong. May require DNS TCP fallback (exceeds 512-byte UDP limit).
RFC 8463 — equivalent to RSA 3072-bit. Compact key, fast verification.
Each email platform uses its own default DKIM selector. This tool auto-probes common selectors when you search without specifying one.
googleselector1, selector2s1, s2 (varies)k1, k2s1, s2proofpoint (varies)DomainKeys Identified Mail (DKIM) Signatures
The core DKIM specification. Defines the DKIM-Signature header, key record format (Section 3.6.1), signing algorithm, and verification process.
Cryptographic Algorithm and Key Usage Update to DKIM
Updates RFC 6376 with modern cryptographic requirements. Mandates RSA 2048-bit minimum and deprecates SHA-1 hashing.
A New Cryptographic Signature Method for DKIM
Adds Ed25519-SHA256 as a DKIM signing algorithm. Provides equivalent security to RSA 3072-bit with a 256-bit key.
Authenticated Received Chain (ARC)
Extends DKIM for message forwarding scenarios. Preserves authentication results across intermediate mail servers.
BIMI (Brand Indicators for Message Identification) allows brands to display their logo in email client inboxes next to authenticated messages. Gmail, Apple Mail, Yahoo Mail, and Fastmail all support BIMI.
The BIMI record is a TXT record at default._bimi.example.com containing a URL to an SVG Tiny 1.2 logo file. For Gmail, a Verified Mark Certificate (VMC) from DigiCert or Entrust is also required. The logo must be a square SVG Tiny 1.2 file. This tool checks for your BIMI record, validates the logo URL, and reports VMC presence.
DKIM is one part of a complete email authentication setup. For full coverage, check your other email DNS records: